We're almost ready to issue certificates for IP address SANs from Let's Encrypt's production environment. They'll only be available under the shortlived profile (which has a 6-day validity period), and that profile will remain allowlist-only for a while. Please note: We have more work to do before …

We will enable it in staging pretty soon. Probably in the next few weeks, once we are confident our implementation is at least close to correct and complete. There’s a bunch of details around things like rate limits, scale, etc which we need to resolve before going to production, but that’s not as …

Would it be correct to assume that the DNS-01 Challenge also cannot be used for the issuance of an IP Address Certificate?

Correct. HTTP and TLS-ALPN only

It's been probably ~15 years since the last time I was messing with (private) IP SAN certs on the regular. But at that time, it seemed like you needed the IP as both an IP and DNS SAN value in the cert for maximum browser compatiblity. Which is to say, some browsers needed one and other browsers nee…

Nice! I see it rendering when using an IPV6 enabled ISP (check here https://test-ipv6.com/ ). [Brave Browser 2025-06-25 17.03.28] Is there plans for the major browsers CA stores to adopt these certs? Can anyone point me to further reading on adoption?

fwiw: If you arrive here trying to paste the link in a browser and do not have IPV6, it will look like this: This site can’t be reached https://[2602:ff3a:1:abad:c0f:fee:abad:cafe]/ is unreachable. ERR_ADDRESS_UNREACHABLE [screenshot-20250626-00-11-34-UTC]

[image] elijahlynn: Is there plans for the major browsers CA stores to adopt these certs? Once launched, these will be issued from Let's Encrypt's existing chain of trust, and so they will be publicly trusted.

Is there anything public available on which IPs will be able to get certs? I mean, obviously private/reserved ranges won't be available, but how about all those "cloud" services that rent IPs by the hour (or second)? Is it expected to be "normal" that someone could release an IP back into a pool and…

We have not made final determination on what IPs we may want to block as being high risk. But they will be generally available.

Happy to see the progress on this. Thought you might be interested in seeing how important this feature is going to be for the Small Web: [image] Web Numbers Domains? Where we’re going, we don’t need domains! Until the end of this year, the only way to have a secure web site is to have…

Getting ready to issue IP address certificates

Issuance Tech

aral June 26, 2025, 3:12pm 22

Happy to see the progress on this.

Thought you might be interested in seeing how important this feature is going to be for the Small Web:

It’s going to be invaluable for helping decentralise the web.

Thank you for the work you do

Topic		Replies	Views
Questions regarding "Announcing Six Day and IP Address Certificate Options in 2025" Help	48	2260	February 10, 2025
When will Let's Encrypt's IP certificates be officially launched? Feature Requests	99	6837	December 24, 2025
Subject Alternative Name (SAN) : field type ipAddress (IP in a CSR) Issuance Policy	23	24999	August 3, 2017
Certificate for public IP without domain name Issuance Tech	84	248646	September 20, 2018
IP Address certs and anycast Issuance Tech	16	821	October 16, 2025

Getting ready to issue IP address certificates

Related topics